New ‘zero-click’ spyware hacked phones using targeted ads

Commercial spyware companies have exploited the global online advertising system to hack into phones and computers, infecting dozens of devices simply by showing them an ad.

Research from the University of Toronto’s Citizen Lab and US cyber security company Confiant found that a new spyware-delivery technique, dubbed “AdFection”, had been used to infect devices belonging to journalists and staff at the Al Jazeera news network.

Hundreds of thousands of ads run by the same network that compromised those devices were also targeted at officials and employees at organisations including Nato, the European Commission, US chipmaker Nvidia and UK chip designer Arm.

The technology, developed by Israeli company Discover-Tech, turns the system that processes trillions of online advertising transactions every day into a covert surveillance tool, enabling users to identify targets and hack their devices, according to the report.

The spyware requires no interaction from the victim to be installed, distinguishing it from conventional spyware infections that typically rely on persuading people to click on malicious links or download infected files.

“Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform,” said Bill Marczak, a senior researcher at Citizen Lab.

Discover-Tech was listed as a certified advertising vendor by Google and the Brussels-based industry association IAB Europe until those organisations were shown the researchers’ findings.

“Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” Google said in a statement to the FT. IAB said it had suspended the company from its global vendor list pending further investigation.

Citizen Lab’s researchers are among the world’s leading experts on the misuse of commercial spyware. In 2019, Marczak was part of a team that revealed the exploitation of WhatsApp by Israel’s NSO Group to hack the phones of reporters, activists and political figures, including the fiancée of murdered Saudi journalist Jamal Khashoggi.

According to Citizen Lab’s new research, Discover-Tech’s platform was used to target journalists and staff at Al Jazeera in 2024 and 2025, infecting at least 45 devices with commercial spyware developed by another Israeli company named Candiru. Data reviewed by the researchers suggests the platform may have been used to deliver spyware developed by other Israeli companies too.

“Discover-Tech is surely just the tip of the iceberg,” Marczak said, noting that “plugging into the online ads ecosystem” provided mercenary spyware vendors with “a stealthy delivery system and a robust pipeline of valuable targets”.

Discover-Tech was registered in Israel in March 2020 by director and chief executive Dekel Boni, records show. The business presents itself as a “legitimate” advertising company but serves as “a bridge” between advertising vendors and spyware companies, according to Citizen Lab’s report. Discover-Tech and Boni did not respond to requests for comment.

Candiru was blacklisted by the US government in 2021, four months after a joint investigation by Citizen Lab and Microsoft accused it of developing a spyware — dubbed DevilsTongue — used to target more than 100 politicians, journalists and others. Candiru could not be reached for comment.

Targeted online advertising works through an automated auction system, known as real-time bidding, that allows advertisers to compete to show an ad to a particular internet user, often in less than a tenth of a second. The process is managed via advertising exchanges, run by companies such as Google and Yandex, that send a bid request to potential advertisers including pseudonymous information about the user such as their approximate location, IP address and browsing history.

Normally this data is used by companies to tailor their advertising. Discover-Tech’s software uses the same information to profile and de-anonymise the user before deciding whether to target them with spyware, according to the report. If the user is targeted for hacking, their device is sent malicious code buried in the seemingly innocuous ad, infecting them with spyware.

A dataset recovered by Citizen Lab showed that Discover-Tech had bid to buy advertising space 3.7bn times between March and June 2026, winning 442mn times. Discover-Tech’s ads were then displayed on more than 120,000 websites, including news sites for the BBC and New York Times, and more than 70,000 mobile apps, including Yahoo Mail, Duolingo and dating apps Badoo and Grindr, according to the report.

In addition to those targeted at Nato and the EU, many of the users targeted during this period appeared to work in government, law enforcement or critical-infrastructure-related entities in Norway, Sweden and Denmark. Discover-Tech adverts were also sent to devices at US defence contractor Raytheon and in the semiconductor industry at companies including Nvidia, Sandisk and Arm, the research showed.

At a minimum, Discover-Tech would have used these ads to profile those users, Citizen Lab researchers said, adding that “urgent investigation” was required to confirm whether spyware infection took place.